What is the CVSS score of EUVD-2026-11909?

EUVD-2026-11909 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by EUVD-2026-11909?

CVE-2026-32395 presents moderate security risk, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate EUVD-2026-11909?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Wordpress Plugin EUVD-2026-11909

| CVE-2026-32395 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Xpro Addons For Beaver Builder 8211 Lite Xpro

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11909

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in Xpro Xpro Addons For Beaver Builder – Lite xpro-addons-beaver-builder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xpro Addons For Beaver Builder – Lite: from n/a through <= 1.5.6.

AnalysisAI

A Missing Authorization vulnerability (CWE-862) exists in Xpro Addons For Beaver Builder - Lite versions up to 1.5.6, allowing unauthenticated attackers to exploit incorrectly configured access control mechanisms and perform unauthorized modifications. The vulnerability has a CVSS score of 5.3 with a network attack vector requiring no privileges or user interaction, indicating an integrity impact without confidentiality or availability compromise. While the CVSS is moderate, the lack of authentication requirement and network accessibility make this a meaningful risk for WordPress sites using this plugin.

Technical ContextAI

Xpro Addons For Beaver Builder – Lite is a WordPress plugin (CPE: cpe:2.3:a:xpro:xpro-addons-beaver-builder-elementor) that extends the Beaver Builder page builder with additional components and functionality. The vulnerability stems from CWE-862 (Missing Authorization), a failure to verify user permissions before granting access to sensitive operations. This occurs when the plugin's access control security levels are incorrectly configured, likely in AJAX endpoints, REST API routes, or admin functions that fail to validate the current user's capabilities before executing privileged actions. The root cause appears to be inadequate use of WordPress capability checks (such as current_user_can()) or missing nonce verification, allowing any user—including unauthenticated visitors—to trigger state-changing operations.

RemediationAI

Upgrade Xpro Addons For Beaver Builder – Lite to a patched version newer than 1.5.6 as soon as available. Check the WordPress plugin repository (wordpress.org/plugins/xpro-addons-beaver-builder-elementor) or contact Xpro directly for the patched release. As a temporary mitigation while waiting for a patch, restrict access to the WordPress admin and Beaver Builder interface using IP whitelisting, require Web Application Firewall (WAF) rules to block suspicious AJAX or REST requests to the plugin, and consider disabling the plugin entirely if it is not actively in use. Additionally, audit site activity logs for unauthorized modifications and consider implementing a content versioning or rollback capability.